CVE-2026-76401

Received Received - Intake

Denial of Service in Splunk Connect for Kafka

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76401

EUVD

EUVD-2026-62966

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_connect_for_kafka	to 2.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated user with access to the Kafka Connect REST API could exploit it by configuring timestamp extraction with a specially crafted regular expression. This could cause a Kafka Connect worker thread to block, halting event delivery for the affected connector. The issue arises because timestamp extraction evaluates user-supplied regular expressions without enforcing a time limit.

Detection Guidance

Check if Splunk Connect for Kafka versions below 2.2.7 are installed. Monitor Kafka Connect REST API logs for unusual activity or blocked worker threads. Look for connectors with timestamp extraction configured using regular expressions.

Impact Analysis

If exploited, this vulnerability could disrupt data flow by stopping event delivery for a Kafka connector. This may lead to loss of critical data, delayed processing, or system downtime for services relying on real-time data ingestion through Splunk Connect for Kafka.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR or HIPAA by disrupting data processing and event delivery in Splunk Connect for Kafka. If event data is blocked due to the vulnerability, it may lead to incomplete or delayed data logging, which could affect audit trails and data integrity requirements under these regulations.

Mitigation Strategies

Upgrade Splunk Connect for Kafka to version 2.2.7 or later. Disable or restrict access to the Kafka Connect REST API if not required. Implement rate limiting or timeouts for regular expression evaluations in timestamp extraction.

Hi! I’m here to help you understand CVE-2026-76401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70